build: only publish images on push to main (#176)

Author: jmgilman

.github/workflows/nix.yml

@@ -42,22 +42,15 @@ jobs:
       - name: Standard Discovery
         uses: divnix/std-action/discover@main
         id: discovery
-  publish-containers:
+  build-packages:
     needs: discover
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJSON(needs.discover.outputs.hits).containers.publish }}
+        target: ${{ fromJSON(needs.discover.outputs.hits).packages.build }}
     name: ${{ matrix.target.cell }} - ${{ matrix.target.name }}
     runs-on: ubuntu-latest
     steps:
-      - name: Configure Registry
-        run: |
-          aws ecr get-login-password --region eu-central-1 | docker login --username AWS --password-stdin "${{ env.ECR_REGISTRY }}"
-        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
-          AWS_DEFAULT_REGION: eu-central-1
       - uses: divnix/std-action/run@main
         with:
           extra_nix_config: |
@@ -67,15 +60,12 @@ jobs:
           s3_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           s3_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           cache: ${{ env.S3_CACHE }}
-  build-packages:
-    if: always()
-    needs:
-      - discover
-      - publish-containers
+  build-devshells:
+    needs: discover
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJSON(needs.discover.outputs.hits).packages.build }}
+        target: ${{ fromJSON(needs.discover.outputs.hits).devshells.build }}
     name: ${{ matrix.target.cell }} - ${{ matrix.target.name }}
     runs-on: ubuntu-latest
     steps:
@@ -88,18 +78,25 @@ jobs:
           s3_id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           s3_key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           cache: ${{ env.S3_CACHE }}
-  build-devshells:
-    if: always()
+  publish-containers:
+    if: github.ref == 'refs/heads/main'
     needs:
       - discover
-      - publish-containers
+      - build-packages
     strategy:
       fail-fast: false
       matrix:
-        target: ${{ fromJSON(needs.discover.outputs.hits).devshells.build }}
+        target: ${{ fromJSON(needs.discover.outputs.hits).containers.publish }}
     name: ${{ matrix.target.cell }} - ${{ matrix.target.name }}
     runs-on: ubuntu-latest
     steps:
+      - name: Configure Registry
+        run: |
+          aws ecr get-login-password --region eu-central-1 | docker login --username AWS --password-stdin "${{ env.ECR_REGISTRY }}"
+        env:
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: eu-central-1
       - uses: divnix/std-action/run@main
         with:
           extra_nix_config: |